Last updated
Was this helpful?
Last updated
Was this helpful?
Netskope log ingestion is in open beta starting with Panther version 1.72, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.
Panther has the ability to fetch Netskope logs by querying the .
You'll start creating the Netskope source in Panther, generate an API token in Netskope, then return to Panther to finish log source creation.
In the left-side navigation bar of your Panther Console, click Configure > Log Sources.
Click Create New.
Search for “Netskope,” then click its tile.
In the slide-out panel, click Start Setup.
Enter a descriptive Name for the source, e.g., "My Netskope logs."
Click Setup.
In a separate web browser tab, open the .
In the left-side navigation bar, click Settings.
In the left-side navigation bar of the Settings page, click Tools > REST API v2.
Click New Token.
In the popup modal, configure the following fields:
Token Name: Enter a descriptive name.
Expire In: Set an appropriate expiration period.
Scope: Click Add Endpoint and select the /api/v2/events/data/audit
scope.
Click Save.
In the confirmation modal, click Copy Token and store the value in a secure location, as you will need it in the next step.
In the Netskope Domain field, enter the domain name of your Netskope tenant (e.g., corp.goskope.com
).
Click Setup. You will be directed to a success screen:
The Trigger an alert when no events are processed setting defaults to YES. We recommend leaving this enabled, as you will be alerted if data stops flowing from the log source after a certain period of time. The timeframe is configurable, with a default of 24 hours.
Panther supports Netskope.Audit
logs.
Navigate back to the Panther Console, to the Set Credentials page where you left off after completing .
In the API Key field, paste the API token value you copied from the Netskope Admin console in .
You can optionally enable one or more .
Netskope.Audit logs represent activity within a Netskope instance. For more information, see .
Panther supports pulling logs directly from Netskope